posted in Technology
US sanctions force The Netherlands off Microsoft and toward alternative NixOS-based software ecosystem
www.tomshardware.com/software/the-netherlands-is-rolling-alternative-nixos-based-software-ecosystem-after-u-s-sanctions-on-icc-took-microsoft-off-the-table-trial-programs-running-now-first-release-expected-at-end-of-2027Replying to @tirateimas@lemmy.pt
I can explain a major reason why public services and administration are begrudgingly moving to FOSS or OSS at all. They need to apply security standards like ISO 27001 and when they start going through what the documentation requires they realize that most OSS let alone FOSS make it very hard to have any say in the development of the software.
How do you make sure that the security flaws are patched promptly? Do you open a ticket on GitHub and simply hope it gets picked up by the devs? I can tell you from experience that some OSS devs will tell you to make your own merge request if it’s so important to you. GDPR makes having vulnerable public facing services very unattractive. What about support for the product when you need something fixed or have an issue with running the software?
You can definitely get a license for an OSS, or get a legal agreement for support from the OSS devs for money. I can guarantee you that when managers in public services look at either patching together and managing a bunch of separate OSS or using Microsofts integrated infrastructure, they see the advantages right away.
That is the sad truth… It’s resource intensive and a regulatory problem to create and manage a whole infrastructure. It’s much easier to use integrated and centralized solutions.
Replying to @DigitalNeighbor@lemmy.world
Don’t get me started about ISO. They can go fuck themselves.
But that particular standard doesn’t apply to software. It applies to a company. Its a best practices, audited authoritative report. None of that means the software doesnt have backdoors, flaws, issues, its how they handle them.
Microsoft is a known ISO cheater, and will pay off companies or at least influence them, so I wouldn’t trust ISO or the auditors.
So now, any company that is willing to take on the challenge of being certified can use open source software (which actually is audit-able as opposed to Microsoft’s).
Seems like there is a path forward. Yes they may have to fund a project that helps audit, develop, or maintain critical software. If its open source, you have an entire world could also participate in securely developing software, in the open.